CVE-2026-30961: 
NixOS vulnerability analysis and mitigation

CVE-2026-30961 is a file upload size limit bypass vulnerability in Gokapi, a self-hosted file sharing server. The chunked upload completion path for file requests fails to validate the total assembled file size against the per-request MaxSize limit, allowing any user with a public file request link to upload files exceeding the administrator-configured quota. All versions up to and including v2.2.3 are affected; the issue was fixed in v2.2.4. It was published on March 13, 2026, with a CVSS v3.1 base score of 4.3 (Moderate) (Github Advisory, Gokapi Advisory).

The root cause is improper input validation (CWE-20) and allocation of resources without limits or throttling (CWE-770) in the chunked upload completion handler. When a file is uploaded in multiple chunks, each chunk is individually validated against the MaxSize limit, but the server never checks whether the sum of all chunks exceeds the per-request configured maximum. An attacker with access to a public file request link can split an arbitrarily large file into chunks each just under MaxSize, upload them sequentially, and trigger the completion endpoint — resulting in the full oversized file being accepted up to the server's global MaxFileSizeMB ceiling. No authentication beyond possession of the shared link is required (Github Advisory, Gokapi Advisory).

Successful exploitation allows any guest with a shared file request link to consume server storage far beyond the administrator-configured per-request limit, up to the server's global MaxFileSizeMB. This can lead to unauthorized storage exhaustion, circumvention of administrative resource policies, and potential service disruption through disk space depletion. The advisory explicitly notes that no data exposure, confidentiality breach, or privilege escalation occurs (Github Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.014% (2nd percentile), indicating a very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires only possession of a valid public file request link, which lowers the practical barrier for abuse in environments where such links are widely shared (Github Advisory).

1. Obtain a file request link: Acquire a public Gokapi file request URL shared by an administrator (e.g., https://<gokapi-host>/fileRequest/<token>).
2. Identify the MaxSize limit: Attempt a test upload to determine the per-request size limit enforced by the link.
3. Split the oversized file: Divide the target file into chunks each smaller than the MaxSize limit using standard tools (e.g., split on Linux or equivalent).
4. Upload chunks sequentially: Submit each chunk to the Gokapi chunked upload endpoint via HTTP POST requests, referencing the same upload session/token.
5. Trigger upload completion: Send the completion request to the chunked upload completion endpoint; the server assembles the chunks without validating the total size, accepting the full oversized file up to the global MaxFileSizeMB limit.
6. Repeat to exhaust storage: Repeat the process to fill server disk space, potentially causing service disruption (Github Advisory).

• Network: Unusually high volume of HTTP POST requests to the Gokapi chunked upload endpoint from a single IP or user agent; sequential chunk uploads that individually appear within size limits but collectively exceed the configured MaxSize.
• File System: Rapid growth of the Gokapi upload/storage directory; presence of many large assembled files in the file request storage path that exceed the per-request configured limit.
• Logs: Gokapi access logs showing repeated chunked upload requests for the same file request token with a large number of chunk submissions; completed uploads with total file sizes significantly above the per-request MaxSize setting.

Upgrade Gokapi to version 2.2.4 or later, which validates the total assembled file size against the per-request MaxSize limit during chunked upload completion. The v2.2.4 release also addresses two additional moderate-severity vulnerabilities and is recommended for all users. No configuration-based workaround is available for unpatched versions; restricting access to file request links to trusted users can reduce exposure in the interim (Gokapi Release, Github Advisory).